You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
60 lines
1.5 KiB
60 lines
1.5 KiB
package cryptostore
|
|
|
|
import (
|
|
"github.com/pkg/errors"
|
|
crypto "github.com/tendermint/go-crypto"
|
|
)
|
|
|
|
var (
|
|
// SecretBox uses the algorithm from NaCL to store secrets securely
|
|
SecretBox Encoder = secretbox{}
|
|
// Noop doesn't do any encryption, should only be used in test code
|
|
Noop Encoder = noop{}
|
|
)
|
|
|
|
// Encoder is used to encrypt any key with a passphrase for storage.
|
|
//
|
|
// This should use a well-designed symetric encryption algorithm
|
|
type Encoder interface {
|
|
Encrypt(key crypto.PrivKey, pass string) ([]byte, error)
|
|
Decrypt(data []byte, pass string) (crypto.PrivKey, error)
|
|
}
|
|
|
|
func secret(passphrase string) []byte {
|
|
// TODO: Sha256(Bcrypt(passphrase))
|
|
return crypto.Sha256([]byte(passphrase))
|
|
}
|
|
|
|
type secretbox struct{}
|
|
|
|
func (e secretbox) Encrypt(key crypto.PrivKey, pass string) ([]byte, error) {
|
|
if pass == "" {
|
|
return key.Bytes(), nil
|
|
}
|
|
s := secret(pass)
|
|
cipher := crypto.EncryptSymmetric(key.Bytes(), s)
|
|
return cipher, nil
|
|
}
|
|
|
|
func (e secretbox) Decrypt(data []byte, pass string) (key crypto.PrivKey, err error) {
|
|
private := data
|
|
if pass != "" {
|
|
s := secret(pass)
|
|
private, err = crypto.DecryptSymmetric(data, s)
|
|
if err != nil {
|
|
return crypto.PrivKey{}, errors.Wrap(err, "Invalid Passphrase")
|
|
}
|
|
}
|
|
key, err = crypto.PrivKeyFromBytes(private)
|
|
return key, errors.Wrap(err, "Invalid Passphrase")
|
|
}
|
|
|
|
type noop struct{}
|
|
|
|
func (n noop) Encrypt(key crypto.PrivKey, pass string) ([]byte, error) {
|
|
return key.Bytes(), nil
|
|
}
|
|
|
|
func (n noop) Decrypt(data []byte, pass string) (crypto.PrivKey, error) {
|
|
return crypto.PrivKeyFromBytes(data)
|
|
}
|